@stigmer/runner 3.10.0 → 3.11.1-dev.20260812192248

package/dist/activities/execute-deep-agent/subagent-wiring.js

@@ -2,6 +2,12 @@
  * Sub-agent middleware composition for ExecuteDeepAgent.
  *
  * Each sub-agent gets its own middleware stack with:
+ * - Path normalization (issue #429), FIRST and only on permission-rule-
+ *   bearing graphs (plan mode) — workspace-relative paths are rewritten to
+ *   workspace-absolute before deepagents' permission validation refuses
+ *   them, exactly as on the parent. `compileSubagents` derives it from the
+ *   same `permissions` option it bakes into the graph, keeping the rules
+ *   and their normalization shim coupled.
  * - Fresh loop detection (independent cycle tracking)
  * - Fresh tool truncation (same limits as parent)
  * - Periodic execution budget (interval=30, max=4 advisories)
@@ -9,11 +15,16 @@
  *   bypassed) — installed only when the parent itself is gated
  *   (`approvalGate` present; absent under auto-approve-all)
  * - Shared cost cap view (parent's budget, no reset on sub-agent start)
+ * - Error hints (issue #255): a thrown tool error becomes a recoverable
+ *   ToolMessage exactly as on the parent. Without it, any tool throw — a
+ *   plan-mode permission denial, an MCP hiccup — propagated out of the
+ *   sub-agent graph and killed the whole delegated task, losing all its
+ *   accumulated work, where the parent's identical error is one failed
+ *   tool round the model adapts to.
  *
  * The sub-agent middleware stack does NOT include:
  * - Graceful stop (parent handles STOP signal propagation)
  * - OTel spans (parent's OTel context propagates automatically)
- * - Error hints (applied at tool level, not sub-agent level)
  *
  * Approval-gate note: the gate is what *creates* the LangGraph `interrupt()`.
  * A sub-agent's interrupt does surface at the parent checkpoint and resumes
@@ -21,23 +32,32 @@
  * the gate runs inside the sub-agent in the first place — omitting it here was
  * the live HITL bypass this wiring closes.
  */
+import { createPathNormalizationMiddleware } from "../../middleware/path-normalization.js";
 import { createLoopDetectionMiddleware } from "../../middleware/loop-detection.js";
 import { createToolTruncationMiddleware } from "../../middleware/tool-truncation.js";
 import { createExecutionBudgetMiddleware } from "../../middleware/execution-budget.js";
 import { createApprovalGateMiddleware, } from "../../middleware/approval-gate.js";
+import { createErrorHintsMiddleware } from "../../middleware/error-hints.js";
 const SUB_AGENT_ADVISORY_INTERVAL = 30;
 const SUB_AGENT_MAX_ADVISORIES = 4;
 /**
  * Build the middleware stack for a single sub-agent.
  *
  * Returns an ordered array mirroring the parent composition:
- * loop detection → execution budget (periodic) → tool truncation →
- * [approval gate] → cost cap view. The gate sits before the cost-cap view so an
- * approval pause happens before budget accounting, matching the parent order
- * (…→ truncation → graceful-stop → approval gate → cost cap …).
+ * [path normalization] → loop detection → execution budget (periodic) →
+ * tool truncation → [approval gate] → cost cap view → error hints.
+ * Normalization is outermost so everything downstream observes canonical
+ * workspace-absolute paths (matching the parent). The gate sits before the
+ * cost-cap view so an approval pause happens before budget accounting, and
+ * error hints come after the gate — both matching the parent order
+ * (…→ truncation → graceful-stop → approval gate → cost cap → error hints …),
+ * which keeps the gate's HITL interrupt outside the hints' try/catch.
  */
 export function buildSubAgentMiddleware(options = {}) {
     const stack = [];
+    if (options.pathNormalization) {
+        stack.push(createPathNormalizationMiddleware(options.pathNormalization));
+    }
     stack.push(createLoopDetectionMiddleware({ enabled: true }));
     stack.push(createExecutionBudgetMiddleware({
         warningInterval: SUB_AGENT_ADVISORY_INTERVAL,
@@ -61,6 +81,7 @@ export function buildSubAgentMiddleware(options = {}) {
     if (options.costCap) {
         stack.push(options.costCap.forSubAgent());
     }
+    stack.push(createErrorHintsMiddleware());
     return stack;
 }
 //# sourceMappingURL=subagent-wiring.js.map

package/dist/activities/execute-deep-agent/subagent-wiring.js.map

@@ -1 +1 @@
-{"version":3,"file":"subagent-wiring.js","sourceRoot":"","sources":["../../../src/activities/execute-deep-agent/subagent-wiring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EACL,4BAA4B,GAE7B,MAAM,mCAAmC,CAAC;AAE3C,MAAM,2BAA2B,GAAG,EAAE,CAAC;AACvC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAsBnC;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAqC,EAAE;IAEvC,MAAM,KAAK,GAAwB,EAAE,CAAC;IAEtC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAE7D,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC;QACzC,eAAe,EAAE,2BAA2B;QAC5C,WAAW,EAAE,wBAAwB;KACtC,CAAC,CAAC,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IAEnE,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,6EAA6E;QAC7E,6EAA6E;QAC7E,uEAAuE;QACvE,0EAA0E;QAC1E,6EAA6E;QAC7E,uEAAuE;QACvE,+EAA+E;QAC/E,2EAA2E;QAC3E,+EAA+E;QAC/E,KAAK,CAAC,IAAI,CAAC,4BAA4B,CACrC,OAAO,CAAC,cAAc;YACpB,CAAC,CAAC,OAAO,CAAC,YAAY;YACtB,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,cAAc,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,CACvF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"subagent-wiring.js","sourceRoot":"","sources":["../../../src/activities/execute-deep-agent/subagent-wiring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAQH,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EACL,4BAA4B,GAE7B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,MAAM,2BAA2B,GAAG,EAAE,CAAC;AACvC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AA4BnC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAqC,EAAE;IAEvC,MAAM,KAAK,GAAwB,EAAE,CAAC;IAEtC,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAE7D,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC;QACzC,eAAe,EAAE,2BAA2B;QAC5C,WAAW,EAAE,wBAAwB;KACtC,CAAC,CAAC,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IAEnE,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,6EAA6E;QAC7E,6EAA6E;QAC7E,uEAAuE;QACvE,0EAA0E;QAC1E,6EAA6E;QAC7E,uEAAuE;QACvE,+EAA+E;QAC/E,2EAA2E;QAC3E,+EAA+E;QAC/E,KAAK,CAAC,IAAI,CAAC,4BAA4B,CACrC,OAAO,CAAC,cAAc;YACpB,CAAC,CAAC,OAAO,CAAC,YAAY;YACtB,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,cAAc,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,CACvF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,0BAA0B,EAAE,CAAC,CAAC;IAEzC,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/activities/hydrate-workflow-execution.js

@@ -175,9 +175,14 @@ function parseWorkflowYaml(yaml, workflowId) {
     }
 }
 async function fetchAndFlattenEnv(client, executionId) {
-    // A desktop runner exchanges its bootstrap credential for a token scoped to
-    // this workflow execution, so cloud's decrypt gate binds the read (#156).
-    // No-op for cloud sandbox and OSS runners.
+    // The runner acquires a token scoped to this workflow execution so the
+    // server's decrypt gate binds the read: a desktop runner exchanges its
+    // bootstrap credential (#156, hard error on failure — the bootstrap
+    // credential no longer decrypts since stigmer-cloud#218, so proceeding
+    // would hydrate redacted placeholders), and an OSS runner asks the
+    // credential-less best-effort exchange (oss#535 — the OSS server redacts
+    // EC reads by default and mints execution-scoped tokens). No-op for cloud
+    // sandbox runners, whose ambient credential is already scoped.
     const scopedToken = await client.acquireScopedRunnerToken({
         workflowExecutionId: executionId,
     });

package/dist/activities/hydrate-workflow-execution.js.map

@@ -1 +1 @@
-{"version":3,"file":"hydrate-workflow-execution.js","sourceRoot":"","sources":["../../src/activities/hydrate-workflow-execution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,yEAAyE,CAAC;AAW1G,MAAM,UAAU,+BAA+B,CAAC,MAAc;IAC5D,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC;QAC/B,QAAQ,EAAE,MAAM,CAAC,sBAAsB;QACvC,KAAK,EAAE,MAAM,CAAC,YAAY;QAC1B,QAAQ,EAAE,MAAM,CAAC,eAAe;QAChC,cAAc,EAAE,MAAM,CAAC,qBAAqB;KAC7C,CAAC,CAAC;IAEH,OAAO;QACL,wBAAwB,EAAE,CAAC,KAAmB,EAA2C,EAAE,CACzF,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAmB,EACnB,MAAqB;IAErB,MAAM,EAAE,YAAY,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAE1E,kEAAkE;IAClE,MAAM,iBAAiB,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,EAAE,cAAc,IAAI,EAAE,CAAC;IACpE,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,EAAE,mBAAmB,CAAC;IAElE,mFAAmF;IACnF,MAAM,kBAAkB,GAAG,MAAM,iBAAiB,CAChD,MAAM,EAAE,WAAW,EAAE,oBAAoB,CAC1C,CAAC;IAEF,oFAAoF;IACpF,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;IAE9E,mCAAmC;IACnC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAE1D,4CAA4C;IAC5C,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAE3D,6CAA6C;IAC7C,MAAM,cAAc,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;IAE3D,OAAO;QACL,KAAK;QACL,cAAc;QACd,GAAG;QACH,QAAQ,EAAE;YACR,YAAY;YACZ,WAAW,EAAE,kBAAkB;YAC/B,oBAAoB;YACpB,MAAM;SACP;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,MAAqB,EACrB,WAAmB;IAEnB,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,IAAI,GAAI,GAAkC,EAAE,IAAI,CAAC;QACvD,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/D,MAAM,kBAAkB,CAAC,YAAY,CACnC,sBAAsB,WAAW,aAAa,EAC9C,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,MAAqB,EACrB,UAAkB,EAClB,kBAA0B;IAE1B,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,kBAAkB,CAAC,YAAY,CACnC,iFAAiF,EACjF,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,kBAAkB,CAAC,YAAY,CACnC,qBAAqB,kBAAkB,8BAA8B,EACrE,2BAA2B,CAC5B,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,GAAG,YAAY,kBAAkB;YAAE,MAAM,GAAG,CAAC;QACjD,MAAM,IAAI,GAAI,GAAkC,EAAE,IAAI,CAAC;QACvD,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/D,MAAM,kBAAkB,CAAC,YAAY,CACnC,qBAAqB,kBAAkB,aAAa,EACpD,6BAA6B,CAC9B,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,iBAAiB,CAC9B,MAAqB,EACrB,UAAkB,EAClB,WAA+B;IAE/B,yEAAyE;IACzE,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YAC9E,IAAI,YAAY,EAAE,aAAa,EAAE,CAAC;gBAChC,OAAO,CAAC,GAAG,CACT,8DAA8D,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAC5F,CAAC;gBACF,OAAO,YAAY,CAAC,aAAa,CAAC;YACpC,CAAC;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,iEAAiE;YACjE,wEAAwE;YACxE,2DAA2D;YAC3D,OAAO,CAAC,IAAI,CACV,8CAA8C,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM;gBAC5E,uCAAuC,EACvC,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,OAAO,gCAAgC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,MAAqB,EACrB,UAAkB;IAElB,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,IAAI,GAAI,GAAkC,EAAE,IAAI,CAAC;QACvD,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/D,MAAM,kBAAkB,CAAC,YAAY,CACnC,aAAa,UAAU,aAAa,EACpC,oBAAoB,CACrB,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAC;IACjE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,kBAAkB,CAAC,YAAY,CACnC,aAAa,UAAU,sDAAsD;YAC7E,8CAA8C,EAC9C,oBAAoB,CACrB,CAAC;IACJ,CAAC;IAED,QAAQ,UAAU,CAAC,KAAK,EAAE,CAAC;QACzB,KAAK,eAAe,CAAC,KAAK;YACxB,MAAM;QACR,KAAK,eAAe,CAAC,OAAO;YAC1B,MAAM,kBAAkB,CAAC,SAAS,CAChC,aAAa,UAAU,8CAA8C,EACrE,oBAAoB,CACrB,CAAC;QACJ,KAAK,eAAe,CAAC,OAAO;YAC1B,MAAM,kBAAkB,CAAC,YAAY,CACnC,aAAa,UAAU,wBAAwB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC7E,oBAAoB,CACrB,CAAC;QACJ,KAAK,eAAe,CAAC,MAAM;YACzB,MAAM,kBAAkB,CAAC,YAAY,CACnC,aAAa,UAAU,4CAA4C;gBACnE,qCAAqC,EACrC,mBAAmB,CACpB,CAAC;QACJ;YACE,MAAM,kBAAkB,CAAC,YAAY,CACnC,aAAa,UAAU,sCAAsC,UAAU,CAAC,KAAK,EAAE,EAC/E,0BAA0B,CAC3B,CAAC;IACN,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,kBAAkB,CAAC,YAAY,CACnC,aAAa,UAAU,gDAAgD;YACvE,iEAAiE;YACjE,wEAAwE,EACxE,YAAY,CACb,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,UAAkB;IACzD,IAAI,CAAC;QACH,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,kBAAkB,CAAC,YAAY,CACnC,+DAA+D,UAAU,MAAM,OAAO,EAAE,EACxF,kBAAkB,CACnB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,MAAqB,EACrB,WAAmB;IAEnB,4EAA4E;IAC5E,0EAA0E;IAC1E,2CAA2C;IAC3C,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC;QACxD,mBAAmB,EAAE,WAAW;KACjC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,iEAAiE;QACjE,uCAAuC;QACvC,MAAM,IAAI,GAAI,GAAkC,EAAE,IAAI,CAAC;QACvD,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/D,OAAO,CAAC,GAAG,CACT,qDAAqD,WAAW,KAAK;gBACrE,mCAAmC,CACpC,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;IAChC,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CACT,6CAA6C,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CACvE,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,cAAsB;IACjD,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"hydrate-workflow-execution.js","sourceRoot":"","sources":["../../src/activities/hydrate-workflow-execution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,yEAAyE,CAAC;AAW1G,MAAM,UAAU,+BAA+B,CAAC,MAAc;IAC5D,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC;QAC/B,QAAQ,EAAE,MAAM,CAAC,sBAAsB;QACvC,KAAK,EAAE,MAAM,CAAC,YAAY;QAC1B,QAAQ,EAAE,MAAM,CAAC,eAAe;QAChC,cAAc,EAAE,MAAM,CAAC,qBAAqB;KAC7C,CAAC,CAAC;IAEH,OAAO;QACL,wBAAwB,EAAE,CAAC,KAAmB,EAA2C,EAAE,CACzF,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAmB,EACnB,MAAqB;IAErB,MAAM,EAAE,YAAY,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAE1E,kEAAkE;IAClE,MAAM,iBAAiB,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,EAAE,cAAc,IAAI,EAAE,CAAC;IACpE,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,EAAE,mBAAmB,CAAC;IAElE,mFAAmF;IACnF,MAAM,kBAAkB,GAAG,MAAM,iBAAiB,CAChD,MAAM,EAAE,WAAW,EAAE,oBAAoB,CAC1C,CAAC;IAEF,oFAAoF;IACpF,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;IAE9E,mCAAmC;IACnC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAE1D,4CAA4C;IAC5C,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAE3D,6CAA6C;IAC7C,MAAM,cAAc,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;IAE3D,OAAO;QACL,KAAK;QACL,cAAc;QACd,GAAG;QACH,QAAQ,EAAE;YACR,YAAY;YACZ,WAAW,EAAE,kBAAkB;YAC/B,oBAAoB;YACpB,MAAM;SACP;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,MAAqB,EACrB,WAAmB;IAEnB,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,IAAI,GAAI,GAAkC,EAAE,IAAI,CAAC;QACvD,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/D,MAAM,kBAAkB,CAAC,YAAY,CACnC,sBAAsB,WAAW,aAAa,EAC9C,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,MAAqB,EACrB,UAAkB,EAClB,kBAA0B;IAE1B,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,kBAAkB,CAAC,YAAY,CACnC,iFAAiF,EACjF,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,kBAAkB,CAAC,YAAY,CACnC,qBAAqB,kBAAkB,8BAA8B,EACrE,2BAA2B,CAC5B,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,GAAG,YAAY,kBAAkB;YAAE,MAAM,GAAG,CAAC;QACjD,MAAM,IAAI,GAAI,GAAkC,EAAE,IAAI,CAAC;QACvD,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/D,MAAM,kBAAkB,CAAC,YAAY,CACnC,qBAAqB,kBAAkB,aAAa,EACpD,6BAA6B,CAC9B,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,iBAAiB,CAC9B,MAAqB,EACrB,UAAkB,EAClB,WAA+B;IAE/B,yEAAyE;IACzE,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YAC9E,IAAI,YAAY,EAAE,aAAa,EAAE,CAAC;gBAChC,OAAO,CAAC,GAAG,CACT,8DAA8D,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAC5F,CAAC;gBACF,OAAO,YAAY,CAAC,aAAa,CAAC;YACpC,CAAC;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,iEAAiE;YACjE,wEAAwE;YACxE,2DAA2D;YAC3D,OAAO,CAAC,IAAI,CACV,8CAA8C,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM;gBAC5E,uCAAuC,EACvC,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,OAAO,gCAAgC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,MAAqB,EACrB,UAAkB;IAElB,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,IAAI,GAAI,GAAkC,EAAE,IAAI,CAAC;QACvD,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/D,MAAM,kBAAkB,CAAC,YAAY,CACnC,aAAa,UAAU,aAAa,EACpC,oBAAoB,CACrB,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAC;IACjE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,kBAAkB,CAAC,YAAY,CACnC,aAAa,UAAU,sDAAsD;YAC7E,8CAA8C,EAC9C,oBAAoB,CACrB,CAAC;IACJ,CAAC;IAED,QAAQ,UAAU,CAAC,KAAK,EAAE,CAAC;QACzB,KAAK,eAAe,CAAC,KAAK;YACxB,MAAM;QACR,KAAK,eAAe,CAAC,OAAO;YAC1B,MAAM,kBAAkB,CAAC,SAAS,CAChC,aAAa,UAAU,8CAA8C,EACrE,oBAAoB,CACrB,CAAC;QACJ,KAAK,eAAe,CAAC,OAAO;YAC1B,MAAM,kBAAkB,CAAC,YAAY,CACnC,aAAa,UAAU,wBAAwB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC7E,oBAAoB,CACrB,CAAC;QACJ,KAAK,eAAe,CAAC,MAAM;YACzB,MAAM,kBAAkB,CAAC,YAAY,CACnC,aAAa,UAAU,4CAA4C;gBACnE,qCAAqC,EACrC,mBAAmB,CACpB,CAAC;QACJ;YACE,MAAM,kBAAkB,CAAC,YAAY,CACnC,aAAa,UAAU,sCAAsC,UAAU,CAAC,KAAK,EAAE,EAC/E,0BAA0B,CAC3B,CAAC;IACN,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,kBAAkB,CAAC,YAAY,CACnC,aAAa,UAAU,gDAAgD;YACvE,iEAAiE;YACjE,wEAAwE,EACxE,YAAY,CACb,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,UAAkB;IACzD,IAAI,CAAC;QACH,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,kBAAkB,CAAC,YAAY,CACnC,+DAA+D,UAAU,MAAM,OAAO,EAAE,EACxF,kBAAkB,CACnB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,MAAqB,EACrB,WAAmB;IAEnB,uEAAuE;IACvE,uEAAuE;IACvE,oEAAoE;IACpE,uEAAuE;IACvE,mEAAmE;IACnE,yEAAyE;IACzE,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC;QACxD,mBAAmB,EAAE,WAAW;KACjC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,iEAAiE;QACjE,uCAAuC;QACvC,MAAM,IAAI,GAAI,GAAkC,EAAE,IAAI,CAAC;QACvD,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/D,OAAO,CAAC,GAAG,CACT,qDAAqD,WAAW,KAAK;gBACrE,mCAAmC,CACpC,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;IAChC,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CACT,6CAA6C,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CACvE,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,cAAsB;IACjD,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/activities/run-command.d.ts

@@ -5,8 +5,11 @@
  * - RunScript: writes inline code to a temp file, executes via node/python
  * - RunShell: executes a shell command directly
  *
- * Both resolve runtime placeholders (JIT secrets) before execution
- * and capture stdout as the activity result.
+ * The child environment follows the declare-to-receive contract in
+ * run-env.ts: a minimal base plus the task's declared `environment`,
+ * with runtime placeholders (JIT secrets) resolved here in the activity
+ * so secret values never enter Temporal history. Both activities capture
+ * stdout as the activity result.
  */
 import type { RunCommandConfig } from "../workflow-engine/types.js";
 export declare function createRunCommandActivities(): {

package/dist/activities/run-command.js

@@ -5,8 +5,11 @@
  * - RunScript: writes inline code to a temp file, executes via node/python
  * - RunShell: executes a shell command directly
  *
- * Both resolve runtime placeholders (JIT secrets) before execution
- * and capture stdout as the activity result.
+ * The child environment follows the declare-to-receive contract in
+ * run-env.ts: a minimal base plus the task's declared `environment`,
+ * with runtime placeholders (JIT secrets) resolved here in the activity
+ * so secret values never enter Temporal history. Both activities capture
+ * stdout as the activity result.
  */
 import { execFile, exec } from "node:child_process";
 import { writeFile, mkdtemp, rm } from "node:fs/promises";
@@ -14,7 +17,9 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { promisify } from "node:util";
 import { ApplicationFailure } from "@temporalio/activity";
+import { RuntimePlaceholderResolutionError } from "../workflow-engine/resolve.js";
 import { startHeartbeat } from "../shared/heartbeat.js";
+import { buildRunEnv } from "./run-env.js";
 const execFileAsync = promisify(execFile);
 const execAsync = promisify(exec);
 export function createRunCommandActivities() {
@@ -45,7 +50,7 @@ async function runScriptImpl(config) {
     }
     const language = config.language;
     const code = config.code;
-    const env = buildEnv(config.environment);
+    const env = buildTaskEnv(config);
     const ext = language === "js" ? ".js" : ".py";
     const interpreter = language === "js" ? "node" : "python3";
     let tempDir;
@@ -82,7 +87,7 @@ async function runShellImpl(config) {
     const fullCommand = args.length > 0
         ? `${command} ${args.join(" ")}`
         : command;
-    const env = buildEnv(config.environment);
+    const env = buildTaskEnv(config);
     try {
         const { stdout } = await execAsync(fullCommand, {
             env,
@@ -98,14 +103,21 @@ async function runShellImpl(config) {
         throw err;
     }
 }
-function buildEnv(taskEnv) {
-    const base = { ...process.env };
-    if (taskEnv) {
-        for (const [k, v] of Object.entries(taskEnv)) {
-            base[k] = v;
+/**
+ * Build the child env per the run-env.ts contract, translating a missing
+ * placeholder key into a non-retryable failure — retrying cannot conjure
+ * a variable the workflow's runtime env does not have.
+ */
+function buildTaskEnv(config) {
+    try {
+        return buildRunEnv(config.environment, config.runtimeEnv);
+    }
+    catch (err) {
+        if (err instanceof RuntimePlaceholderResolutionError) {
+            throw ApplicationFailure.nonRetryable(err.message, "RUN_ENV_UNRESOLVED_PLACEHOLDER", { variable: err.variableName });
         }
+        throw err;
     }
-    return base;
 }
 function buildArgsList(args) {
     if (!args)

package/dist/activities/run-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-command.js","sourceRoot":"","sources":["../../src/activities/run-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AAElC,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,MAAwB;YACtC,MAAM,EAAE,GAAG,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC;gBACH,OAAO,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;YACrC,CAAC;oBAAS,CAAC;gBACT,EAAE,CAAC,IAAI,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,MAAwB;YACrC,MAAM,EAAE,GAAG,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC;gBACH,OAAO,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,CAAC;oBAAS,CAAC;gBACT,EAAE,CAAC,IAAI,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAwB;IACnD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,kBAAkB,CAAC,YAAY,CAAC,yCAAyC,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAS,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAK,CAAC;IAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAEzC,MAAM,GAAG,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9C,MAAM,WAAW,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAE3D,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,GAAG,EAAE,CAAC,CAAC;QACjD,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAEnD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,EAAE;YACzE,GAAG;YACH,OAAO,EAAE,OAAO;YAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC5B,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,kBAAkB,CAAC,YAAY,CACnC,sCAAsC,GAAG,CAAC,IAAI,GAAG,EACjD,yBAAyB,EACzB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAC3D,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,MAAwB;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,kBAAkB,CAAC,YAAY,CAAC,uCAAuC,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAQ,CAAC;IAChC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;QACjC,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAChC,CAAC,CAAC,OAAO,CAAC;IACZ,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAEzC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE;YAC9C,GAAG;YACH,OAAO,EAAE,OAAO;YAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC5B,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,kBAAkB,CAAC,YAAY,CACnC,mCAAmC,GAAG,CAAC,IAAI,GAAG,EAC9C,wBAAwB,EACxB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAC3D,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CACf,OAAgC;IAEhC,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAChC,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AACxB,CAAC;AAQD,SAAS,WAAW,CAAC,GAAY;IAC/B,OAAO,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"run-command.js","sourceRoot":"","sources":["../../src/activities/run-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,iCAAiC,EAAE,MAAM,+BAA+B,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AAElC,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,MAAwB;YACtC,MAAM,EAAE,GAAG,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC;gBACH,OAAO,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;YACrC,CAAC;oBAAS,CAAC;gBACT,EAAE,CAAC,IAAI,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,MAAwB;YACrC,MAAM,EAAE,GAAG,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC;gBACH,OAAO,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,CAAC;oBAAS,CAAC;gBACT,EAAE,CAAC,IAAI,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAwB;IACnD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,kBAAkB,CAAC,YAAY,CAAC,yCAAyC,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAS,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAK,CAAC;IAC1B,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAEjC,MAAM,GAAG,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9C,MAAM,WAAW,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAE3D,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,GAAG,EAAE,CAAC,CAAC;QACjD,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAEnD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,EAAE;YACzE,GAAG;YACH,OAAO,EAAE,OAAO;YAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC5B,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,kBAAkB,CAAC,YAAY,CACnC,sCAAsC,GAAG,CAAC,IAAI,GAAG,EACjD,yBAAyB,EACzB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAC3D,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,MAAwB;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,kBAAkB,CAAC,YAAY,CAAC,uCAAuC,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAQ,CAAC;IAChC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;QACjC,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAChC,CAAC,CAAC,OAAO,CAAC;IACZ,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAEjC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE;YAC9C,GAAG;YACH,OAAO,EAAE,OAAO;YAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC5B,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,kBAAkB,CAAC,YAAY,CACnC,mCAAmC,GAAG,CAAC,IAAI,GAAG,EAC9C,wBAAwB,EACxB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAC3D,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,MAAwB;IAC5C,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,GAAG,YAAY,iCAAiC,EAAE,CAAC;YACrD,MAAM,kBAAkB,CAAC,YAAY,CACnC,GAAG,CAAC,OAAO,EACX,gCAAgC,EAChC,EAAE,QAAQ,EAAE,GAAG,CAAC,YAAY,EAAE,CAC/B,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AACxB,CAAC;AAQD,SAAS,WAAW,CAAC,GAAY;IAC/B,OAAO,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,CAAC;AAC/C,CAAC"}

package/dist/activities/run-env.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Environment contract for the workflow `run` task (shell and script modes).
+ *
+ * Declare-to-receive, the same rule the stdio MCP contract adopted after
+ * #256 (PR #383): the child process sees ONLY
+ *
+ *   1. a minimal base copied from the runner process
+ *      ({@link RUN_ENV_BASE_KEYS} — the six variables the MCP SDK pins),
+ *   2. the task's declared `environment` map, with `${.secrets.KEY}` /
+ *      `${.env_vars.KEY}` placeholders resolved just-in-time from the
+ *      workflow's runtime env. Resolution happens here in the activity,
+ *      never in the deterministic workflow phase, so secret values stay
+ *      out of Temporal history.
+ *
+ * Runner credentials (STIGMER_TOKEN, the HITL secret, provider keys) are
+ * structurally absent rather than denylisted — a workflow-authored
+ * `printenv` cannot read what was never passed (oss#384). A missing
+ * placeholder key fails loudly: running a command with a silently-empty
+ * credential produces cryptic downstream failures.
+ *
+ * Placeholders resolve only in declared environment VALUES, never in
+ * `command` / `code` strings — argv is visible to `ps` on the host, so
+ * the environment is the sanctioned channel for secrets.
+ */
+/**
+ * Base variables copied from the runner process when present — the same
+ * six the MCP SDK provides to stdio servers, so "undeclared subprocess
+ * environment" has one platform-wide answer. `PATH` keeps interpreters
+ * and tools findable; the rest keep shells and language runtimes sane.
+ */
+export declare const RUN_ENV_BASE_KEYS: readonly string[];
+/**
+ * Build the environment for a run task's child process: minimal base +
+ * declared overlay with strict placeholder resolution (declared wins on
+ * conflict with the base).
+ *
+ * @throws RuntimePlaceholderResolutionError when a declared value
+ *   references a runtime key that does not exist.
+ */
+export declare function buildRunEnv(declaredEnv: Readonly<Record<string, string>> | undefined, runtimeEnv: Readonly<Record<string, unknown>>, baseEnv?: NodeJS.ProcessEnv): Record<string, string>;

package/dist/activities/run-env.js

@@ -0,0 +1,66 @@
+/**
+ * Environment contract for the workflow `run` task (shell and script modes).
+ *
+ * Declare-to-receive, the same rule the stdio MCP contract adopted after
+ * #256 (PR #383): the child process sees ONLY
+ *
+ *   1. a minimal base copied from the runner process
+ *      ({@link RUN_ENV_BASE_KEYS} — the six variables the MCP SDK pins),
+ *   2. the task's declared `environment` map, with `${.secrets.KEY}` /
+ *      `${.env_vars.KEY}` placeholders resolved just-in-time from the
+ *      workflow's runtime env. Resolution happens here in the activity,
+ *      never in the deterministic workflow phase, so secret values stay
+ *      out of Temporal history.
+ *
+ * Runner credentials (STIGMER_TOKEN, the HITL secret, provider keys) are
+ * structurally absent rather than denylisted — a workflow-authored
+ * `printenv` cannot read what was never passed (oss#384). A missing
+ * placeholder key fails loudly: running a command with a silently-empty
+ * credential produces cryptic downstream failures.
+ *
+ * Placeholders resolve only in declared environment VALUES, never in
+ * `command` / `code` strings — argv is visible to `ps` on the host, so
+ * the environment is the sanctioned channel for secrets.
+ */
+import { resolveRuntimePlaceholdersStrict } from "../workflow-engine/resolve.js";
+/**
+ * Base variables copied from the runner process when present — the same
+ * six the MCP SDK provides to stdio servers, so "undeclared subprocess
+ * environment" has one platform-wide answer. `PATH` keeps interpreters
+ * and tools findable; the rest keep shells and language runtimes sane.
+ */
+export const RUN_ENV_BASE_KEYS = [
+    "HOME",
+    "LOGNAME",
+    "PATH",
+    "SHELL",
+    "TERM",
+    "USER",
+];
+/**
+ * Build the environment for a run task's child process: minimal base +
+ * declared overlay with strict placeholder resolution (declared wins on
+ * conflict with the base).
+ *
+ * @throws RuntimePlaceholderResolutionError when a declared value
+ *   references a runtime key that does not exist.
+ */
+export function buildRunEnv(declaredEnv, runtimeEnv, baseEnv = process.env) {
+    const env = {};
+    for (const key of RUN_ENV_BASE_KEYS) {
+        const value = baseEnv[key];
+        if (value !== undefined)
+            env[key] = value;
+    }
+    if (!declaredEnv || Object.keys(declaredEnv).length === 0) {
+        // The only case whose behavior changed in oss#384 (previously the
+        // child inherited the full runner env) — leave a trace for operators.
+        console.log("run task declares no environment — child receives the minimal base env only");
+        return env;
+    }
+    for (const [key, value] of Object.entries(declaredEnv)) {
+        env[key] = resolveRuntimePlaceholdersStrict(value, runtimeEnv, `environment "${key}"`);
+    }
+    return env;
+}
+//# sourceMappingURL=run-env.js.map

package/dist/activities/run-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-env.js","sourceRoot":"","sources":["../../src/activities/run-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,MAAM;IACN,SAAS;IACT,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;CACP,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CACzB,WAAyD,EACzD,UAA6C,EAC7C,UAA6B,OAAO,CAAC,GAAG;IAExC,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC5C,CAAC;IAED,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,kEAAkE;QAClE,sEAAsE;QACtE,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;QAC3F,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,GAAG,CAAC,GAAG,gCAAgC,CACzC,KAAK,EACL,UAAU,EACV,gBAAgB,GAAG,GAAG,CACvB,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/activities/workflow-event-activities.d.ts

@@ -3,8 +3,12 @@
  *
  * Converts plain event descriptors (safe for the Temporal deterministic
  * sandbox) into WorkflowExecutionEvent proto objects and sends them
- * alongside a status update via gRPC. Best-effort — failures are logged
- * but do not fail the activity.
+ * alongside a status update via gRPC. Failures propagate so the local
+ * activity's retry policy fires — safe because sequence numbers are
+ * workflow-assigned (stable across attempts) and the store skips
+ * already-persisted sequences, making retries idempotent. The workflow's
+ * emit wrappers catch after retries are exhausted; event emission never
+ * fails a run.
  *
  * Registered as proxyLocalActivities in engine-core.ts so the workflow
  * sandbox can emit events at task boundaries and approval gates.
@@ -14,21 +18,35 @@ import type { WorkflowEventDescriptor } from "../workflow-engine/types.js";
 import type { TaskStatusEntry } from "../workflow-engine/task-status-accumulator.js";
 import type { RecoveryTaskData } from "../workflow-engine/recovery.js";
 /**
- * Initialize the event sequence counter from the persisted high-water mark.
+ * Return the persisted event-log high-water mark for the execution, and
+ * seed the legacy process-global counter from it.
  *
- * On first run (no prior events), the counter stays at 0 and the first
- * event gets sequence_number = 1 — identical to the original behavior.
+ * The workflow seeds its own sequence counter from the returned value
+ * (patched path); the legacy global seed remains for pre-patch replays,
+ * whose emit path still assigns sequences here in the activity.
  *
- * On recovery (events already persisted from a failed run), the counter
- * is set to the highest persisted sequence_number so that new events
- * continue from N+1, avoiding duplicate-key collisions in storage.
+ * On first run (no prior events) returns 0, so the first event gets
+ * sequence_number = 1. On recovery (events already persisted from a
+ * failed run) returns the highest persisted sequence_number, so new
+ * events continue from N+1.
  *
  * When executionId is empty (direct executeServerlessWorkflow without a
- * persisted execution), the counter resets to 0 as a safe fallback.
+ * persisted execution), returns 0 as a safe fallback.
+ *
+ * Returns a plain number — the value crosses back into the workflow
+ * through Temporal's JSON payload converter, which cannot carry BigInt.
  */
-export declare function initSequenceFromEventLog(executionId: string): Promise<void>;
+export declare function initSequenceFromEventLog(executionId: string): Promise<number>;
 /** @internal Exported for unit testing only. */
 export declare function toProtoEvent(desc: WorkflowEventDescriptor): WorkflowExecutionEvent;
+/**
+ * Emit workflow events (with the accompanying status snapshot) to the
+ * server. Errors propagate so the local activity retry policy fires;
+ * retries are idempotent because workflow-assigned sequence numbers are
+ * stable across attempts and the store skips already-persisted ones. The
+ * workflow-side emit wrappers absorb the failure after retries are
+ * exhausted, so a broken timeline write never fails the run.
+ */
 export declare function emitWorkflowEvents(executionId: string, events: WorkflowEventDescriptor[], taskStatuses?: TaskStatusEntry[]): Promise<void>;
 /**
  * Loads recovery context data from the previous run's status snapshot.

package/dist/activities/workflow-event-activities.js

@@ -3,8 +3,12 @@
  *
  * Converts plain event descriptors (safe for the Temporal deterministic
  * sandbox) into WorkflowExecutionEvent proto objects and sends them
- * alongside a status update via gRPC. Best-effort — failures are logged
- * but do not fail the activity.
+ * alongside a status update via gRPC. Failures propagate so the local
+ * activity's retry policy fires — safe because sequence numbers are
+ * workflow-assigned (stable across attempts) and the store skips
+ * already-persisted sequences, making retries idempotent. The workflow's
+ * emit wrappers catch after retries are exhausted; event emission never
+ * fails a run.
  *
  * Registered as proxyLocalActivities in engine-core.ts so the workflow
  * sandbox can emit events at task boundaries and approval gates.
@@ -110,38 +114,60 @@ function buildClient() {
         token: config.stigmerToken,
     });
 }
+/**
+ * LEGACY sequence assignment — only for descriptors that arrive without a
+ * workflow-assigned `sequenceNumber`, i.e. replays of histories recorded
+ * before the "workflow-assigned-event-sequences" patch (see
+ * engine-core.ts). This counter is process-global: it is shared across
+ * every execution on the worker and resets on worker restart, which is
+ * the root cause of oss#308's silent event loss. Deliberately NOT fixed —
+ * pre-patch executions keep their old (flawed) behavior for the
+ * migration window. Delete together with the patch gate once pre-patch
+ * executions have drained.
+ */
 let sequenceCounter = 0;
 function nextSequence() {
     sequenceCounter += 1;
     return BigInt(sequenceCounter);
 }
 /**
- * Initialize the event sequence counter from the persisted high-water mark.
+ * Return the persisted event-log high-water mark for the execution, and
+ * seed the legacy process-global counter from it.
  *
- * On first run (no prior events), the counter stays at 0 and the first
- * event gets sequence_number = 1 — identical to the original behavior.
+ * The workflow seeds its own sequence counter from the returned value
+ * (patched path); the legacy global seed remains for pre-patch replays,
+ * whose emit path still assigns sequences here in the activity.
  *
- * On recovery (events already persisted from a failed run), the counter
- * is set to the highest persisted sequence_number so that new events
- * continue from N+1, avoiding duplicate-key collisions in storage.
+ * On first run (no prior events) returns 0, so the first event gets
+ * sequence_number = 1. On recovery (events already persisted from a
+ * failed run) returns the highest persisted sequence_number, so new
+ * events continue from N+1.
  *
  * When executionId is empty (direct executeServerlessWorkflow without a
- * persisted execution), the counter resets to 0 as a safe fallback.
+ * persisted execution), returns 0 as a safe fallback.
+ *
+ * Returns a plain number — the value crosses back into the workflow
+ * through Temporal's JSON payload converter, which cannot carry BigInt.
  */
 export async function initSequenceFromEventLog(executionId) {
     if (!executionId) {
         sequenceCounter = 0;
-        return;
+        return 0;
     }
     const client = buildClient();
     const highWaterMark = await client.getEventLogHighWaterMark(executionId);
     sequenceCounter = Number(highWaterMark);
+    return sequenceCounter;
 }
 /** @internal Exported for unit testing only. */
 export function toProtoEvent(desc) {
     const base = create(WorkflowExecutionEventSchema, {
         eventId: crypto.randomUUID(),
-        sequenceNumber: nextSequence(),
+        // Workflow-assigned sequence when present (stable across activity
+        // retries); legacy activity-side assignment only for pre-patch replays.
+        sequenceNumber: desc.sequenceNumber !== undefined
+            ? BigInt(desc.sequenceNumber)
+            : nextSequence(),
         occurredAt: desc.occurredAt,
         taskName: desc.taskName ?? "",
     });
@@ -331,58 +357,61 @@ export function toProtoEvent(desc) {
     }
     return base;
 }
+/**
+ * Emit workflow events (with the accompanying status snapshot) to the
+ * server. Errors propagate so the local activity retry policy fires;
+ * retries are idempotent because workflow-assigned sequence numbers are
+ * stable across attempts and the store skips already-persisted ones. The
+ * workflow-side emit wrappers absorb the failure after retries are
+ * exhausted, so a broken timeline write never fails the run.
+ */
 export async function emitWorkflowEvents(executionId, events, taskStatuses) {
     if (!executionId || events.length === 0)
         return;
-    try {
-        const client = buildClient();
-        const protoEvents = events.map(toProtoEvent);
-        const protoTasks = (taskStatuses ?? []).map(ts => create(WorkflowTaskSchema, {
-            taskId: ts.taskId ?? "",
-            taskName: ts.taskName,
-            taskType: TASK_KIND_TO_TYPE_MAP[ts.taskKind] ?? WorkflowTaskType.WORKFLOW_TASK_TYPE_UNSPECIFIED,
-            status: TASK_STATUS_MAP[ts.status],
-            startedAt: ts.startedAt ?? "",
-            completedAt: ts.completedAt ?? "",
-            error: ts.error ?? "",
-            input: toJsonObject(ts.input),
-            output: toJsonObject(ts.output),
-            metadata: toJsonObject(ts.metadata),
-            costMicros: BigInt(ts.costMicros ?? 0),
-            inputTokens: BigInt(ts.inputTokens ?? 0),
-            outputTokens: BigInt(ts.outputTokens ?? 0),
-            uiHint: ts.uiHint ?? "",
-        }));
-        const startedEvent = events.find(e => e.type === "execution_started");
-        const completedEvent = events.find(e => e.type === "execution_completed");
-        const failedEvent = events.find(e => e.type === "execution_failed");
-        const statusFields = { tasks: protoTasks };
-        if (startedEvent) {
-            statusFields.phase = ExecutionPhase.EXECUTION_IN_PROGRESS;
-            statusFields.startedAt = startedEvent.occurredAt;
-        }
-        if (completedEvent && completedEvent.type === "execution_completed") {
-            statusFields.phase = ExecutionPhase.EXECUTION_COMPLETED;
-            statusFields.completedAt = completedEvent.occurredAt;
-            statusFields.totalCostMicros = BigInt(completedEvent.totalCostMicros);
-            statusFields.totalInputTokens = BigInt(completedEvent.totalInputTokens ?? 0);
-            statusFields.totalOutputTokens = BigInt(completedEvent.totalOutputTokens ?? 0);
-        }
-        if (failedEvent && failedEvent.type === "execution_failed") {
-            statusFields.phase = ExecutionPhase.EXECUTION_FAILED;
-            statusFields.completedAt = failedEvent.occurredAt;
-            statusFields.error = failedEvent.error;
-        }
-        const input = create(WorkflowExecutionUpdateStatusInputSchema, {
-            executionId,
-            status: create(WorkflowExecutionStatusSchema, statusFields),
-            events: protoEvents,
-        });
-        await client.workflowExecutionCommand.updateStatus(input);
+    const client = buildClient();
+    const protoEvents = events.map(toProtoEvent);
+    const protoTasks = (taskStatuses ?? []).map(ts => create(WorkflowTaskSchema, {
+        taskId: ts.taskId ?? "",
+        taskName: ts.taskName,
+        taskType: TASK_KIND_TO_TYPE_MAP[ts.taskKind] ?? WorkflowTaskType.WORKFLOW_TASK_TYPE_UNSPECIFIED,
+        status: TASK_STATUS_MAP[ts.status],
+        startedAt: ts.startedAt ?? "",
+        completedAt: ts.completedAt ?? "",
+        error: ts.error ?? "",
+        input: toJsonObject(ts.input),
+        output: toJsonObject(ts.output),
+        metadata: toJsonObject(ts.metadata),
+        costMicros: BigInt(ts.costMicros ?? 0),
+        inputTokens: BigInt(ts.inputTokens ?? 0),
+        outputTokens: BigInt(ts.outputTokens ?? 0),
+        uiHint: ts.uiHint ?? "",
+    }));
+    const startedEvent = events.find(e => e.type === "execution_started");
+    const completedEvent = events.find(e => e.type === "execution_completed");
+    const failedEvent = events.find(e => e.type === "execution_failed");
+    const statusFields = { tasks: protoTasks };
+    if (startedEvent) {
+        statusFields.phase = ExecutionPhase.EXECUTION_IN_PROGRESS;
+        statusFields.startedAt = startedEvent.occurredAt;
     }
-    catch (err) {
-        console.error(`Failed to emit ${events.length} workflow event(s) for ${executionId}:`, err);
+    if (completedEvent && completedEvent.type === "execution_completed") {
+        statusFields.phase = ExecutionPhase.EXECUTION_COMPLETED;
+        statusFields.completedAt = completedEvent.occurredAt;
+        statusFields.totalCostMicros = BigInt(completedEvent.totalCostMicros);
+        statusFields.totalInputTokens = BigInt(completedEvent.totalInputTokens ?? 0);
+        statusFields.totalOutputTokens = BigInt(completedEvent.totalOutputTokens ?? 0);
     }
+    if (failedEvent && failedEvent.type === "execution_failed") {
+        statusFields.phase = ExecutionPhase.EXECUTION_FAILED;
+        statusFields.completedAt = failedEvent.occurredAt;
+        statusFields.error = failedEvent.error;
+    }
+    const input = create(WorkflowExecutionUpdateStatusInputSchema, {
+        executionId,
+        status: create(WorkflowExecutionStatusSchema, statusFields),
+        events: protoEvents,
+    });
+    await client.workflowExecutionCommand.updateStatus(input);
 }
 const PROTO_STATUS_TO_STRING = {
     [WorkflowTaskStatus.WORKFLOW_TASK_IN_PROGRESS]: "started",